Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.RemoteCode.41.origin
- Android.Xiny.20
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) 1####.171.140.85:80
- TCP(HTTP/1.1) yun.tuis####.com:80
- TCP(HTTP/1.1) cdn.danj####.com:80
- TCP(HTTP/1.1) 1####.75.90.129:80
- TCP(HTTP/1.1) v####.6####.com:80
- TCP(HTTP/1.1) acti####.danj####.com.####.com:80
- TCP(HTTP/1.1) p2.ai####.com:80
- TCP(HTTP/1.1) img.danj####.com:80
- TCP(HTTP/1.1) m.v####.com:80
- TCP(HTTP/1.1) m.cnt####.com:80
- TCP(HTTP/1.1) log.cuda####.com:10080
- TCP(HTTP/1.1) ob.nic####.cn:80
- TCP(HTTP/1.1) 1####.75.115.32:80
- TCP(HTTP/1.1) m.cuda####.com:80
- TCP(HTTP/1.1) do.soi####.com.####.com:80
- TCP(HTTP/1.1) z.no####.net:80
- TCP(HTTP/1.1) www.i####.org:80
- TCP(HTTP/1.1) ip.ch####.com:80
- TCP(HTTP/1.1) im####.nic####.cn:80
- TCP(HTTP/1.1) at.al####.com:80
- TCP(HTTP/1.1) sdk.91a####.com:80
- TCP(HTTP/1.1) m1.laogeda####.com:80
- TCP(HTTP/1.1) cd.kw####.com:80
- UDP(NTP) 2.and####.p####.####.org:123
- TCP(TLS/1.0) ad####.tand####.com:443
- TCP(TLS/1.0) hotfix####.oss-cn-####.aliy####.com:443
- TCP(TLS/1.0) api.nic####.cn:443
- TCP(TLS/1.0) act.ad####.cn:443
- TCP(TLS/1.0) bu####.bianxia####.com:443
- TCP(TLS/1.0) z.c####.com:443
- TCP(TLS/1.0) 2b.tand####.com:443
- TCP(TLS/1.0) bxm-g####.oss-cn-####.aliy####.com:443
- TCP(TLS/1.0) a####.b####.com:443
- TCP(TLS/1.0) adsc####.tand####.com:443
- TCP(TLS/1.0) gm.mm####.com:443
- TCP(TLS/1.0) buy.bianxia####.com:443
- TCP(TLS/1.0) acti####.danj####.com.####.com:443
- TCP(TLS/1.0) c.c####.com:443
- TCP(TLS/1.0) aliyuns####.oss-cn-####.aliy####.com:443
- TCP(TLS/1.0) aliyuno####.oss-cn-####.aliy####.com:443
- TCP(TLS/1.0) hm.b####.com:443
DNS requests:
- 2.and####.p####.####.org
- 2b.tand####.com
- a####.b####.com
- act.ad####.cn
- acti####.danj####.com
- ad####.tand####.com
- adsc####.tand####.com
- aliyuno####.oss-cn-####.aliy####.com
- aliyuns####.oss-cn-####.aliy####.com
- aliyuns####.oss-cn-####.aliy####.com
- api.nic####.cn
- at.al####.com
- bu####.bianxia####.com
- buy.bianxia####.com
- bxm-g####.oss-cn-####.aliy####.com
- c####.mm####.com
- c.c####.com
- cd.kw####.com
- cdn.danj####.com
- do.soi####.com
- hm.b####.com
- hotfix####.oss-cn-####.aliy####.com
- im####.nic####.cn
- img.danj####.com
- ip.ch####.com
- log.cuda####.com
- m.cnt####.com
- m.cuda####.com
- m.v####.com
- m1.laogeda####.com
- ob.nic####.cn
- p2.ai####.com
- s22.c####.com
- s23.c####.com
- sdk.91a####.com
- v####.6####.com
- w####.5####.com
- www.i####.org
- yun.tuis####.com
- z.no####.net
- z1.c####.com
- z5.c####.com
HTTP GET requests:
- acti####.danj####.com.####.com/activity/rotate?key=####
- acti####.danj####.com.####.com/dist/base/css/redbox.css
- acti####.danj####.com.####.com/dist/rotate/css/actBase.css
- acti####.danj####.com.####.com/dist/rotate/css/alertskin.css
- acti####.danj####.com.####.com/dist/rotate/css/common.css
- acti####.danj####.com.####.com/dist/rotate/css/index.css
- acti####.danj####.com.####.com/dist/rotate/css/prizelist.css
- at.al####.com/t/font_wsni5ytblm78pvi.ttf
- cdn.danj####.com/img/bg/nh4xzvuva9.jpg
- cdn.danj####.com/img/bg/tmbyrkg11i.png
- do.soi####.com.####.com/201809/wwf.jar
- im####.nic####.cn/group1/M00/00/AB/rBGXxFswiuCAT78cAAAbq2quBfU679.png
- im####.nic####.cn/h5-mami/activity/hand.png
- im####.nic####.cn/h5-mami/activity/rollDick/2.0/png/btn.png
- im####.nic####.cn/h5-mami/activity/rollDick/2.0/png/dice.png
- im####.nic####.cn/h5-mami/activity/rollDick/2.0/png/numBg.png
- im####.nic####.cn/h5-mami/activity/rollDick/2.0/png/prize.png
- im####.nic####.cn/h5-mami/activity/rollDick/2.0/png/prize2.png
- im####.nic####.cn/h5-mami/activity/rollDick/2.0/png/process.png
- im####.nic####.cn/h5-mami/activity/rollDick/2.0/png/result1.png
- im####.nic####.cn/h5-mami/activity/rollDick/2.0/png/result2.png
- im####.nic####.cn/h5-mami/activity/rollDick/2.0/png/result3.png
- im####.nic####.cn/h5-mami/activity/rollDick/2.0/png/result4.png
- im####.nic####.cn/h5-mami/activity/rollDick/2.0/png/result5.png
- im####.nic####.cn/h5-mami/activity/rollDick/2.0/png/result6.png
- im####.nic####.cn/h5-mami/activity/rollDick/2.0/png/rule.png
- im####.nic####.cn/h5-mami/activity/rollDick/2.0/png/rule2.png
- im####.nic####.cn/h5-mami/activity/rollDick/png/coin1.png
- im####.nic####.cn/h5-mami/activity/rollDick/png/coin2.png
- im####.nic####.cn/h5-mami/activity/rollDick/png/coin3.png
- im####.nic####.cn/h5-mami/activity/rollDick/png/couponBtns.png
- im####.nic####.cn/h5/activity/colorball/images/prize_bg.png
- im####.nic####.cn/images/activity/prize/1a6kv6cfs5h.png
- im####.nic####.cn/images/activity/prize/1i5r5wsvp6b.png
- im####.nic####.cn/images/activity/prize/1k3rnftrwu8.png
- im####.nic####.cn/images/activity/prize/1w2lr2kovld.png
- im####.nic####.cn/images/activity/prize/1z52s0ja17z.png
- im####.nic####.cn/mami-media/img/cek0ldw6pp.jpg
- im####.nic####.cn/mami-media/img/ewscwsbz2i.png
- img.danj####.com/img/gifts/4uu27nmhdi.png
- img.danj####.com/img/gifts/6ss5q2o65t.png
- img.danj####.com/img/gifts/7c44te47fr.png
- img.danj####.com/img/gifts/dpk2i9q1fy.png
- img.danj####.com/img/gifts/nelxdl9h2h.png
- img.danj####.com/img/gifts/rkbvinsiby.png
- ip.ch####.com/getip.aspx
- log.cuda####.com:10080/dot/s.gif?t=0.11859938083216548&p=ads&locaurl=htt...
- log.cuda####.com:10080/dot/s.gif?t=0.2866552493069321&p=ads&locaurl=http...
- log.cuda####.com:10080/dot/s.gif?t=0.7282602544873953&p=ads&locaurl=http...
- log.cuda####.com:10080/dot/s.gif?t=0.8343164073303342&p=ads&locaurl=http...
- log.cuda####.com:10080/dot/s.gif?t=0.8512370651587844&p=ads&locaurl=http...
- log.cuda####.com:10080/dot/s.gif?t=0.8522304566577077&p=ads&locaurl=http...
- log.cuda####.com:10080/dot/s.gif?t=0.9078055208083242&p=ads&locaurl=http...
- m.cnt####.com/caizhuangmiji/19/3098.html
- m.cnt####.com/iDdo4VRE1HKF.php?o=####&i=####&s=####&ad=####
- m.cuda####.com/?appKey=####&appType=####&appEntrance=####&business=####
- m.cuda####.com/dist/bxm_base/js/polyfill.min.js
- m.cuda####.com/dist/bxm_base/js/zepto.js
- m.cuda####.com/dist/welfareAT02/public/lib/common/common.js
- m.cuda####.com/dist/welfareAT02/public/lib/common/extend.css
- m.cuda####.com/dist/welfareAT02/public/lib/conf/actConf.js
- m.cuda####.com/dist/welfareAT02/public/lib/statis/Statis_IA.js
- m.cuda####.com/distt/walletModel/bundle20180918.css?ea63756####
- m.cuda####.com/distt/walletModel/index.html?business=####&appkey=####&ui...
- m.cuda####.com/distt/walletModel/js/main20180918.js?ea63756####
- m.cuda####.com/distt/walletModel/null
- m.v####.com/JdcPAGsskmgA.php?o=####&i=####&s=####&ad=####
- m.v####.com/nenyuanqiche/30/8802.html
- m1.laogeda####.com/ads/admaster24.php?o=####
- m1.laogeda####.com/ads/admaster240.php?o=####
- m1.laogeda####.com/templets/tui/js/jquery-1.8.3.min.js
- ob.nic####.cn/huodong/Production/20180809/node_modules/iscroll/build/isc...
- ob.nic####.cn/huodong/Production/20180809/pkg/Common.js
- ob.nic####.cn/huodong/Production/20180809/pkg/Vendor.js
- ob.nic####.cn/huodong/Production/20180809/projects/page/DiceGame/DiceGam...
- ob.nic####.cn/huodong/Production/20180809/projects/page/DiceGame/css/ski...
- p2.ai####.com/activity/index?key=####
- sdk.91a####.com/static/20180829152952mod.enc
- yun.tuis####.com/h5-mami/activity/turnCircle/image/point.png
- yun.tuis####.com/h5-mami/activity/turnCircle/image/rule.png
- yun.tuis####.com/mami-media/img/lx5ysx9baj.png
- yun.tuis####.com/mami-media/img/mcgf1kjs3d.png
- yun.tuis####.com/mami-media/img/x11j1n2t7d.png?x-oss-process=####
HTTP POST requests:
- cd.kw####.com/c
- ob.nic####.cn/niceapi/getactivity
- ob.nic####.cn/niceapi/getactivitybuoy
- ob.nic####.cn/niceapi/orderdatainfo
- sdk.91a####.com/api/DeviceReport.ashx
- v####.6####.com/api/CheckModule.ashx
- v####.6####.com/api/GetModuleConfig.ashx
- www.i####.org/two?requestId=####&g=####
- z.no####.net/m/a/f
- z.no####.net/m/a/t
Modified file system:
Creates the following files:
- /data/data/####/0RxA8iG.jar
- /data/data/####/JSON.xml
- /data/data/####/SVcoQIlE.jar
- /data/data/####/W_Key.xml
- /data/data/####/WebViewSettings.xml
- /data/data/####/aSX3XSn.jar
- /data/data/####/base.js
- /data/data/####/common.js
- /data/data/####/countClickIP.xml
- /data/data/####/cpro.baidu.com.js
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/downloadswc
- /data/data/####/downloadswc-journal
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/index
- /data/data/####/m.baidu.com.js
- /data/data/####/m.chinebuy.com.js
- /data/data/####/max_pref.xml
- /data/data/####/mod.dec
- /data/data/####/mod.dex
- /data/data/####/mod.enc
- /data/data/####/org.SoGoyyb.PoPchengyu_preferences.xml
- /data/data/####/org_SoGoyyb_PoPchengyu.txt
- /data/data/####/ork6X9jiP2.jar
- /data/data/####/phan.xml
- /data/data/####/st.xml
- /data/data/####/start.js
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/5.0wwf.jar.u
- /data/media/####/id.tmp
- /data/media/####/org_SoGoyyb_PoPchengyu.txt
- /data/media/####/restime.dat
Miscellaneous:
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS7Padding
- DES-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS5Padding
- DES
- DES-CBC-PKCS5Padding
Gains access to geolocation.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Gains access to information about installed applications.
Adds tasks to the system scheduler.
Displays its own windows over windows of other applications.
